Refactor default wireguard setup

- Replaced set_fact based setup with lookup plugin
- Replaced inline definition of credentials with alternative
  systemd file directives

tasks/wireguard.yml

@@ -1,24 +1,3 @@
-- name: Load private key into var
-  ansible.builtin.set_fact:
-    vpn_server_key: '{{ lookup("file", "files/wireguard/default/server.key") }}'
-
-- name: Load public key into var
-  ansible.builtin.set_fact:
-    vpn_server_public_key: '{{ lookup("file", "files/wireguard/default/server.pub") }}'
-
-# this should eventually be replaced with using the
-# PrivateKeyFile/PresharedKeyFile options
-- name: Load preshared keys into variables
-  ansible.builtin.set_fact:
-    vpn_peers: '{{ vpn_peers | combine({item.key: item.value | combine({"preshared_key": lookup("file", item.value.preshared_key_source_path)})}) }}'
-  with_dict: '{{ vpn_peers }}'
-
-- name: Load mobile private_key
-  ansible.builtin.set_fact:
-    vpn_peers: '{{ vpn_peers | combine({item.key: item.value | combine({"private_key": lookup("file", item.value.private_key_source_path)})}) }}'
-  with_dict: '{{ vpn_peers }}'
-  when: item.key == "mobile"
-
 - name: Copy wireguard configuration files
   become: true
   ansible.builtin.template:
@@ -50,10 +29,11 @@
     mode: '0640'
     state: directory
   loop:
+    - '{{ vpn_key_directory }}'
     - '{{ vpn_server_key_path }}'
     - '{{ vpn_server_public_key_path }}'
 
-- name: Copy wireguard credentials
+- name: Copy Wireguard server credentials
   become: true
   ansible.builtin.copy:
     src: '{{ item.src }}'
@@ -66,8 +46,9 @@
       dest: '{{ vpn_server_public_key_path }}'
     - src: 'files/wireguard/default/server.key'
       dest: '{{ vpn_server_key_path }}'
+  notify: restart systemd-networkd
 
-- name: Copy mobile wireguard credentials
+- name: Copy Wireguard mobile credentials
   become: true
   ansible.builtin.copy:
     src: '{{ item.src }}'
@@ -77,9 +58,10 @@
     mode: '0640'
   loop:
     - src: 'files/wireguard/default/mobile.pub'
-      dest: '{{ vpn_server_public_key_path | dirname }}/mobile.pub'
+      dest: '{{ vpn_key_directory }}/public/mobile.pub'
     - src: 'files/wireguard/default/mobile.key'
-      dest: '{{ vpn_server_key_path | dirname }}/mobile.key'
+      dest: '{{ vpn_key_directory }}/private/mobile.key'
+  notify: restart systemd-networkd
 
 - name: Copy wireguard preshared keys
   become: true
@@ -90,3 +72,4 @@
     group: systemd-network
     mode: '0640'
   with_dict: '{{ vpn_peers }}'
+  notify: restart systemd-networkd